The four eyes principle for small businesses

Key takeaways

The four eyes principle means that certain actions need two people: one to do, one to check. Small businesses that do everything in-house often have one person doing a whole process alone, with nobody to catch an error or stop a fraud. A few targeted second checks fix most of the risk.

• 4 eyes = 2 people: one prepares, a different one approves.
• Apply it to payments, payroll, new supplier details and published content.
• A small team can use the owner, a rota or an outside reviewer as checker.
• Checking 1 item in 10 is enough for low-risk routine work.

What is the four eyes principle?

The four eyes principle is a control under which a transaction or decision must be approved by at least two people. It is also called the two-person rule, and it is closely related to segregation of duties, where no single person controls every step of a process.

• The hidden costs of doing everything in-house
• The cost of poor quality in a small business

Why do in-house teams often lack it?

Small in-house teams lack it because there is only one person in each function. The bookkeeper raises, approves and pays. The marketing assistant writes, edits and publishes. Trust replaces control, which works until a mistake or a dishonest act goes unnoticed.

• The one-person department: risks and hidden costs

Which tasks need a second pair of eyes?

Use a second check where an error is expensive, hard to reverse or public.

• Payments and bank transfers above a set value.
• Changes to supplier or employee bank details.
• Payroll before it is submitted.
• Quotes and contracts before they are sent.
• Anything published under the business's name.
• Bulk emails to customers.

How do you apply it with a small team?

Apply it by choosing a checker who is not the doer. In a team of three that might be the owner for payments and a colleague for content. Banking platforms support dual approval. Where nobody internal can judge the work, an external accountant, agency or managed team can act as the second pair of eyes.

The National Cyber Security Centre advises checking payment detail changes through a separate, trusted channel, which is a four eyes control against invoice fraud.

• Quality assurance for outsourced teams

When is a second check overkill?

A second check is overkill for low-value, reversible, routine items. Checking everything doubles the labour and trains people to approve without looking. Use full checks for high-risk items and sample checks for the rest.

What does a missing second check cost?

A missing second check costs nothing for years and then a great deal at once. A payment sent to a fraudster's account is often unrecoverable. A payroll error affects every employee and takes days to unwind. A price list published with a wrong figure may have to be honoured. These events are infrequent, which is exactly why a team of one stops expecting them.

How do you set thresholds?

Set thresholds by value and reversibility, and write them down.

• Payments above a set amount: two approvers in online banking.
• Any change to bank details: verified by phone on a known number.
• Payroll: reviewed by someone other than the preparer before submission.
• Contracts and quotes above a set value: read by a second person.
• Routine low-value items: a sample check, such as one in ten.

What makes a second check effective?

A second check works only if the checker looks independently. That means checking against the source, not against the preparer's summary, and having enough time and knowledge to spot a problem. A manager who approves fifty items in two minutes is providing a signature, not a control. Fewer, real checks protect more than many nominal ones.

How does it apply when work is outsourced?

The same rule applies to an outside team. A managed provider should have its own internal checks, and you should keep approval of anything that moves money or commits the business. In practice this often improves on the in-house position, because preparation and approval end up with different people by design.

• Quality assurance for outsourced teams

What does this look like in practice?

A pattern we see in payment fraud attempts: an email asks the bookkeeper to update a supplier's bank details. With one person handling it, the change is made. With a rule that a second person phones the supplier on a known number, the attempt fails.

• See client work
• BPO Solutions for UK businesses

Four eyes checklist

Set this up in a week.

• List tasks one person completes alone from start to finish.
• Mark those involving money, contracts or publication.
• Name a checker for each.
• Turn on dual approval in online banking.
• Set sample checks for routine work.

• The hidden cost audit: score your business in an hour

Next step

Tell us which processes one person runs alone. We will suggest where a second check matters most in a 30-minute call.